# Paradox of De-identification: A Critique of HIPAA Safe Harbour in the Age of LLMs

arXiv: https://arxiv.org/abs/2602.08997 · HTML: https://mlsanity.com/paper/2602.08997/

## Key facts

- Cited by 1 papers in the map (data through 14 Oct 2026).
- Builds on 8 of its 32 references that are in the map.
- First posted on arXiv 9 Feb 2026.

## Builds on (most cited first, 8 of 8)

- [BERT: Pre-training of Deep Bidirectional Transformers for Language Understanding](https://mlsanity.com/paper/1810.04805/) (2018)
- [Quantifying Memorization Across Neural Language Models](https://mlsanity.com/paper/2202.07646/) (2022)
- [OLMo: Accelerating the Science of Language Models](https://mlsanity.com/paper/2402.00838/) (2024)
- [Differentially Private Synthetic Data via Foundation Model APIs 1: Images](https://mlsanity.com/paper/2305.15560/) (2023)
- [Adversarial Learning of Privacy-Preserving Text Representations for De-Identification of Medical Records](https://mlsanity.com/paper/1906.05000/) (2019)
- [Advancing Science- and Evidence-based AI Policy](https://mlsanity.com/paper/2508.02748/) (2025)
- [Machine Learners Should Acknowledge the Legal Implications of Large Language Models as Personal Data](https://mlsanity.com/paper/2503.01630/) (2025)
- [Privacy-Preserving Dataset Combination](https://mlsanity.com/paper/2502.05765/) (2025)

## Built on by (most cited first, 1 of 1)

- [Clinically Grounded Privacy Evaluation of Medical LMs](https://mlsanity.com/paper/2606.09590/) (2026)

## Abstract (arXiv)

Privacy is a human right that sustains patient-provider trust. Clinical notes capture a patient's private vulnerability and individuality, which are used for care coordination and research. Under HIPAA Safe Harbor, these notes are de-identified to protect patient privacy. However, Safe Harbor was designed for an era of categorical tabular data, focusing on the removal of explicit identifiers while ignoring the latent information found in correlations between identity and quasi-identifiers, which can be captured by modern LLMs. We first formalize these correlations using a causal graph, then validate it empirically through individual re-identification of patients from scrubbed notes. The paradox of de-identification is further shown through a diagnosis ablation: even when all other information is removed, the model can predict the patient's neighborhood based on diagnosis alone. This position paper raises the question of how we can act as a community to uphold patient-provider trust when de-identification is inherently imperfect. We aim to raise awareness and discuss actionable recommendations.